Container Vulnerability Scanning with Grype

Overview

Grype is an open-source vulnerability scanner that identifies known security flaws in container images, filesystems, and Software Bill of Materials (SBOM) documents. It analyzes operating system packages (Alpine, Ubuntu, Red Hat, Debian) and language-specific dependencies (Java, Python, JavaScript, Ruby, Go, PHP, Rust) against vulnerability databases to detect CVEs.

Grype emphasizes actionable security insights through:

• CVSS severity ratings for risk classification
• EPSS exploit probability scores for threat assessment
• CISA Known Exploited Vulnerabilities (KEV) indicators
• Multiple output formats (table, JSON, SARIF, CycloneDX) for toolchain integration

Quick Start